with builtins; { resource = { graylog_pipeline_connection = { journald.pipeline_ids = [ "\${graylog_pipeline.nextcloud.id}" ]; }; graylog_pipeline = { nextcloud.source = '' pipeline "nextcloud : parsing" stage 10 match either rule "nextcloud : parse level 1" stage 11 match either rule "nextcloud : parse level 2" end ''; }; graylog_pipeline_rule = { nextcloudLevel1.source = '' rule "nextcloud : parse level 1" when has_field("systemd_unit") && $message.systemd_unit == "phpfpm-nextcloud.service" then let parsedJson = parse_json(to_string($message.message)); set_fields(to_map(parsedJson),"nextcloud_"); end ''; nextcloudLevel2.source = '' rule "nextcloud : parse level 2" when has_field("nextcloud_message") then let parsedJson = parse_json(to_string($message.nextcloud_message)); set_fields(to_map(parsedJson),"nextcloud_message_"); end ''; }; }; }